0x33B - Teknik - CVE 2025 54068 - Deep dive into Livewire

0x33B - Teknik - CVE 2025 54068 - Deep dive into Livewire

by PolySécure Podcast · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 PolySécure Podcast 👥 540 📅 September 9, 2026 ⏱ 20 min 👁 0 📄 expert opinion 🧭 2026-09-09
Available in: English (current) Français

Keywords

CVELivewirePHPgadget chainRCE

Summary

In this podcast episode, the host interviews two security researchers, Remy Matas and Pierre Martin, about their discovery and disclosure of a critical remote code execution (RCE) vulnerability in Livewire, a popular PHP library used with Laravel. The conversation covers how they noticed PHP objects being exchanged in requests, which led to a code audit and the identification of an arbitrary object instantiation flaw. They found a gadget chain that could be exploited to achieve RCE, but initially required a valid APP_KEY signature. After reporting this to the Livewire team, they were initially told it wasn’t a vulnerability due to the secret requirement. However, they discovered a bypass that allowed exploitation without the key, leading to CVE-2025-54068. The researchers report that they notified the developers in July, received a rapid response, and a patch was released within two days. They coordinated to withhold public disclosure for three months to give users time to update. Upon publication, the exploit was quickly adopted by threat actors, including an Iranian state-sponsored group targeting US government entities, prompting CISA to add it to its Known Exploited Vulnerabilities catalog. The episode also discusses the mixed reactions from the community, including developers who blamed Livewire or PHP, and highlights the importance of promptly applying patches and using tools like Composer to manage dependencies. The researchers conclude with recommendations: update dependencies, audit your system, and rotate APP_KEY if compromised.

232 words

Critical Evaluation

Value of the Information & Strength of the Argument

The interview provides valuable firsthand insight into the practical steps of vulnerability research, from initial suspicion to final publication and aftermath. The researchers explain their reasoning clearly, showing how they moved from spotting risky PHP object serialization to building a gadget chain and ultimately achieving RCE without a required secret. Their argumentation is solid as they describe the logical progression of their investigation, the interaction with the vendor, and the consequences of disclosure. They also present a balanced view of the community’s reactions, acknowledging both legitimate concerns and misplaced blame. The narrative is compelling and educational, offering a realistic view of the challenges and responsibilities in security research.

Scientific Rigor, Source Quality, Title Accuracy

Regarding scientific rigor, the video relies on the firsthand testimony of the researchers, which adds credibility but lacks verifiable external sources. No specific references or links are given in the description, and the only named reference is the CVE itself. The researchers mention tools and platforms like Composer, Filament, and CISA, but without detailed citations. The title is appropriate, as the content indeed focuses on CVE-2025-54068 and Livewire, though it is more of a narrative than a technical deep dive. The overall rigor is acceptable for an expert discussion, but would benefit from additional references. The lack of provided comments prevents any analysis of public reception.

229 words

Title / Content Match

The title accurately reflects the content, which is a deep dive into CVE-2025-54068 affecting Livewire, albeit more focused on the narrative and aftermath than on pure technical code.

Quality & Reliability

7/10

The two researchers are credible security experts, and their account of the vulnerability discovery and disclosure process is coherent and detailed. However, the video lacks direct references or evidence to independently verify the claims, and no external sources are provided.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • CVE-2025-54068 — The vulnerability discussed throughout the episode, which allows remote code execution in Livewire.

Contribution & Novelties

This video offers a unique case study of the full lifecycle of a high-impact CVE, from discovery to coordinated disclosure and eventual exploitation by threat actors. It highlights the importance of persistence in vulnerability research and the critical role of vendor collaboration. The narrative underscores the consequences of delayed patching and the rapid weaponization of public exploits.

Pour aller plus loin :

  • CVE-2025-54068 detail — Official CVE record with technical details.
  • CISA Known Exploited Vulnerabilities Catalog — CISA’s list of actively exploited vulnerabilities, mentioned in the context of government remediation mandates.
  • Livewire GitHub repository — Source code and release history for the affected library, where the patch and blacklist policy can be examined.
  • Gadget chain concept — A technique used to chain objects for arbitrary method calls, central to the exploit; no specific URL provided due to uncertainty, but it is a well-known concept in PHP security.

147 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with slightly lower technical depth and reliability due to the lack of external verification. The video is informative but relies primarily on the researchers' narrative, making it a useful introduction rather than a technical manual.

Reliability 7/10